OB_POST_OPERATION_INFORMATION - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// wdm.h
typedef struct _OB_POST_OPERATION_INFORMATION {
OB_OPERATION Operation;
union {
ULONG Flags;
struct {
ULONG KernelHandle : 1;
ULONG Reserved : 31;
};
};
PVOID Object;
POBJECT_TYPE ObjectType;
PVOID CallContext;
NTSTATUS ReturnStatus;
POB_POST_OPERATION_PARAMETERS Parameters;
} OB_POST_OPERATION_INFORMATION, *POB_POST_OPERATION_INFORMATION;
View the official Windows Driver Kit DDI referenceNo description available.
The OB_POST_OPERATION_INFORMATION structure provides information about a process or thread handle operation to an ObjectPostCallback routine.
OperationThe type of handle operation. This member might be one of the following values:
A new handle to a process or thread was created. Use Parameters->CreateHandleInformation for create-specific information.
A process or thread handle was duplicated. Use Parameters->DuplicateHandleInformation for duplicate-specific information.
FlagsReserved. Use the KernelHandle member instead.
KernelHandleA ULONG value that specifies whether the handle is a kernel handle. If this value is TRUE, the handle is a kernel handle. Otherwise, the handle is not a kernel handle.
ReservedReserved for system use.
ObjectA pointer to the process or thread object that is the target of the handle operation.
ObjectTypeA pointer to the object type of the object. This type can be PsProcessType for a process or PsThreadType for a thread.
CallContextA pointer to driver-specific context information for the operation. This value is the value that the OperationInformation->CallContext member specifies to the ObjectPreCallback routine.
ReturnStatusThe NTSTATUS value for the handle operation.
ParametersA pointer to an OB_POST_OPERATION_PARAMETERS union that contains operation-specific information. The Operation member determines which member of the union is valid. The pointer is valid only when ReturnStatus is a success code.
Unlike the OB_PRE_OPERATION_INFORMATION structure, the members of the OB_POST_OPERATION_INFORMATION structure are purely informational; you cannot modify them.